The security of current magnetic stripe cards is suspect due to the ease of card theft and ‘skimming’ of card data for creating and using fake cards. As shown in FIG. 1, current magnetic stripe cards 100, such as access, credit, debit, identification, security, stored value and vendor-specific cards, typically have a strip of magnetic material 102, which is commonly referred to as a magnetic stripe, embedded in a plastic or laminated substrate 104. This magnetic stripe 102 carries data for the cardholder, such as name, account number, card expiration date, and other important information. This information is typically stored in three data tracks within the magnetic stripe 102 that carry a pattern of magnetization, which is a magnetic representation of the stored information. Other common features of magnetic stripe cards 100 that are well known to those skilled in the art, such as the cardholder's name, account number, expiration date, issuer, signature stripe, validation code, photograph, etc., are not shown. The magnetic patterns on the magnetic stripes 102 are easily created, read and damaged. As a result, the security of cards 100 that rely solely on magnetic stripes 102 for information storage and authentication is low and renders their use in applications involving highly sensitive information suspect. These types of cards are easily stolen and/or the data is “skimmed” for the creation and use of fake or counterfeit cards.
One way to increase the security of information bearing cards is the use of smart cards, also referred to as chip cards. Although smart cards 200 may also include a magnetic stripe, they primarily rely on an integrated circuit, also commonly referred to as a controller or processor, embedded within the plastic or laminated substrate 204 below the terminals 202 to store the cardholder's information as shown in FIG. 2. The integrated circuit is communicably coupled to a set of metallic terminals 202 that are designed to interface with a special reader. Other common features of smart cards 200 that are well known to those skilled in the art, such as the cardholder's name, account number, expiration date, issuer, signature stripe, validation code, photograph, etc., are not shown. A smart card 200 is capable of incorporating multiple applications or accounts on a single card or other media. As a result, smart cards 200 are widely recognized as a viable way to improve the effectiveness and security of a given card or device. Such smart cards 200 require a different reader from the standard magnetic stripe readers that currently make up virtually the entire card reader infrastructure throughout the world. As a result, the acceptance and wide-spread use of “true” smart cards (without a magnetic stripe) has been slow.
Various compromise technologies have been developed that incorporate some of the flexibility and security features of smart cards into a magnetic stripe card using either an adapter or a programmable magnetic stripe. For example, a smart card to magnetic stripe adapter is disclosed in US Patent Application Publication 2003/0057278 A1 published on Mar. 27, 2003 entitled “Advanced Magnetic Stripe Bridge (AMSB)” by Jacob Y. Wong. The Wong patent application describes an adapter or bridge that is used with magnetic stripe card readers such that a smart card or other card without a magnetic stripe can be placed into the bridge and electrically connected to the card. The bridge has one edge that is the size of a credit card so that the bridge can be swiped through the magnetic stripe reader while the card is still in the bridge. With this link in place, the data from the card is transmitted from the on-card processor through the bridge in a format that emulates the data generated by swiping the track(s) of a typical magnetic card through a magnetic stripe reader. As a result, the magnetic stripe reader is able to accept data from the magnetic stripe-less card. Similarly, one developer, ViVOTech, Inc., places a fixed bridge in the magnetic stripe reader that is capable of receiving radio frequency (“RF”) data and then emulates the feed of data into the magnetic stripe reader via RF to complete the transaction without requiring physical contact of the card with the reader. Both of these technologies require either a fixed or mobile adaptor to be added to the card-reader infrastructure to enable data to be read from the card. While this is possible, it is still a modification to the world-wide infrastructure that is undesirable for unfettered use of the card. The use of such a bridge is cumbersome, adds cost and reduces reliability. In addition, this method also does not incorporate authentication of the user to provide protections against skimming or use by unauthorized individuals.
The use of a programmable magnetic stripe is disclosed in US Patent Application Publication 2002/0003169 A1 published on Jan. 10, 2002 entitled “Universal Credit Card Apparatus and Method” by J. Carl Cooper. The Cooper patent application describes a card in which a number of electrical coils are built into the card with one coil under each data bit on the magnetic stripe on the card so that each coil, when excited under the control of the on-card processor, creates a magnetic field that can magnetize the data bit in the magnetic track to be either a 0 or 1, thereby yielding a binary code that, when applied in accordance with the ISO standard for magnetic stripe cards, can be read by standard card readers. With this on-card capability in place, the processor can essentially “write” any data stored in the processor's memory to the on-card magnetic stripe. As with the adapter, the Cooper patent application does not provide any protections against card skimming or use by unauthorized persons. Moreover, because of the need for numerous individual coils (one beneath each data bit on the magnetic stripe), significant cost is incurred when adding these coils to the on-card design. The power requirements of such a card are also problematic.
There is, therefore, a need for a practical and secure card that has the advantages of a smart card and will interface with magnetic stripe readers without the use of adapters. Moreover, there is a need for a proper authentication in multiple account/application cards and devices to reduce the risk to the device holder in the event of loss or fraudulent capture of the data within the multiple accounts on the device.